CVE-2018-5284 ImageInject <= 1.15 - Cross-Site Scripting
MediumCVSS 4.8
EPSS 0.80%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The ImageInject plugin 1.15 for WordPress has XSS via the flickr_appid parameter to wp-admin/options-general.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| wpscoop imageinject | = 1.15 | No fix listed |
| wordpress wp-inject(WordPress) | < 1.16 | 1.16 |
References
- github.com exploit third-party-advisory
- wordpress.org broken-link
- wpvulndb.com third-party-advisory
- Wordfence Intelligence third-party-advisory
- www.cve.org